HallucC — Hallucination & Safety Guardian

Classify CUA Actions

check_cua_actions

Read-only

Computer-Use Agent 动作风险分级。提交动作轨迹 → 逐步返回 L0(放行)/L1(放行+记录)/L2(需确认)/L3(阻断)/takeover(凭据场景挂起等用户亲手输入) 裁决、matched_rules、outcome，及 L0-L3 汇总计数；响应含 ruleset_version（规则库版本）与 disclaimer（本结果仅为分级参考，未执行实际拦截）。覆盖：敏感路径/破坏性命令/不可逆元素语义、域名分级（未知域导航 L2、黑名单域与敏感粘贴到未知域 L3、支付金额超阈值 L3）、凭据词表与支付/登录域 takeover、task_scope 任务意图偏离（越界升一级，只能收窄）、多智能体委托链字段（每条动作可选 chain_id/agent_id/parent_agent_id/delegation_depth，给了则服务端追加链级跨跳污点分析：跨 agent 传播时聚合级别抬到 L3 并置 risk_diluted，返回在 chain_trace 字段；未给则零影响）。纯规则判定，不调 LLM、不耗额度。用于在 agent 执行前/后做安全自检。

Input Schema

Name	Required	Description
`actions`	Yes	待分级的动作序列（1~500 条）
`session_id`	No	给了则把分级结果写入审计表，可在 /cua/audit 回放
`task_scope`	No	任务意图对齐（收窄机制）：动作越出 scope 时升一级处置（L0→L1、L1→L2、L2 保持但追加原因、L3 不变）。只能升级不能降级；不传则零影响。

Output Schema

Name	Required	Description	Default
`chains`	No
`results`	No
`summary`	No
`warning`	No
`disclaimer`	No
`session_id`	No
`chain_trace`	No
`has_propagation`	No
`injection_steps`	No
`ruleset_version`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 19, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": {},
+  "properties": {
+    "chain_trace": {
+      "anyOf": [
+        {},
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "chains": {
+      "anyOf": [
+        {
+          "items": {},
+          "type": "array"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "disclaimer": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "has_propagation": {
+      "type": [
+        "boolean",
+        "null"
+      ]
+    },
+    "injection_steps": {
+      "anyOf": [
+        {
+          "maximum": 9007199254740991,
+          "minimum": -9007199254740991,
+          "type": "integer"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "results": {
+      "anyOf": [
+        {
+          "items": {
+            "additionalProperties": {},
+            "properties": {
+              "action": {
+                "anyOf": [
+                  {
+                    "additionalProperties": {},
+                    "propertyNames": {
+                      "type": "string"
+                    },
+                    "type": "object"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "level": {
+                "anyOf": [
+                  {
+                    "enum": [
+                      "L0",
+                      "L1",
+                      "L2",
+                      "L3"
+                    ],
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "matched_rules": {
+                "anyOf": [
+                  {
+                    "items": {},
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "outcome": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "reasons": {
+                "anyOf": [
+                  {
+                    "items": {
+                      "type": "string"
+                    },
+                    "type": "array"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "step": {
+                "anyOf": [
+                  {
+                    "maximum": 9007199254740991,
+                    "minimum": -9007199254740991,
+                    "type": "integer"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              },
+              "verdict": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              }
+            },
+            "type": "object"
+          },
+          "type": "array"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "ruleset_version": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "session_id": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "summary": {
+      "anyOf": [
+        {
+          "additionalProperties": {},
+          "properties": {
+            "L0": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "L1": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "L2": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "L3": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "blocked": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "confirm": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "takeover": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "total": {
+              "anyOf": [
+                {
+                  "maximum": 9007199254740991,
+                  "minimum": -9007199254740991,
+                  "type": "integer"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          "type": "object"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "warning": {
+      "type": [
+        "string",
+        "null"
+      ]
+    }
+  },
+  "type": "object"
+}

First observedOct 8, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, but the description adds substantial behavior the annotations cannot express: pure rule engine with no LLM call and no quota consumption, the tool does NOT actually block anything (disclaimer), session_id has an audit-table write side effect, and the optional chain_id/agent_id/parent_agent_id/delegation_depth fields trigger server-side cross-agent taint analysis that can raise the aggregate to L3 with risk_diluted returned in chain_trace. It also explains the narrowing-only semantics of task_scope. Nothing here contradicts the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and verdict vocabulary, and every clause carries information (rule coverage, takeover conditions, chain behavior, cost profile). It is, however, one very dense run-on paragraph of nested parentheticals, which is harder to scan than it could be given the amount of content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even though an output schema exists (so return values need not be described), the description still enumerates the rule families, the takeover triggers, the optional audit/chain fields and the non-blocking caveat. For a nested-object classifier with side effects, an agent has everything it needs to call it correctly and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description genuinely adds semantics on top: task_scope can only upgrade a verdict (L0→L1, L1→L2) and never downgrades, the delegation-chain parameters are optional and have zero effect when omitted, and session_id enables audit replay. These are behavioral contracts the per-field schema text does not fully convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource in the first phrase (Computer-Use Agent 动作风险分级) and immediately describes the input (动作轨迹) and output shape (逐步 L0/L1/L2/L3/takeover 裁决、matched_rules、outcome、汇总计数). The CUA-action scope cleanly separates it from siblings like check_cua_code_audit, check_safety, verify_agent and verify_text without needing to name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete usage context — "用于在 agent 执行前/后做安全自检" — which tells the agent when this tool belongs in a workflow. It does not, however, state exclusions or explicitly point to an alternative sibling (e.g. check_cua_code_audit for source-level checks), so routing between the five check_/verify_ tools is still partly inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All HallucC — Hallucination & Safety Guardian tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.